Security & data handling
Your ROs are customer data. Here is exactly what happens to them.
Short version: no customer fields at all, an isolated environment per dealer, a tool that only reads what it was given, a model that proposes and never decides, an evidence log of every access, and deletion on request. Groups can run the whole thing on a VM they control.
No customer data, by design
The check reads the RO number, dates, the 3Cs, labor lines, punch times, approvals, parts and sublet. It never reads a customer's name, address or phone. Suppress those fields in the export; we send a redaction script that runs on your side, and the VIN can be cut to make and model year.
Isolation
Each dealer's data lives in its own environment, never pooled. Access is by named user; anonymous requests are refused by design. Data is retained for the engagement and deleted within 30 days of a written request, with confirmation.
The model does not hold the keys
Model calls run through a gateway on short-lived warrants. No provider API key exists on the machine that holds your documents. Your documents are never used to train any model, ours or a vendor's.
The only door is a scoped tool
The agent never reads files directly. All access goes through one tool that refuses paths outside the dealer's store, bounds every output, allows read-only SQL, and appends every call to an evidence log. The database does all arithmetic; the model reads the rules for parameters and judges the hits.
Findings are verified before they are recorded
A finding is refused unless its citations resolve to real lines in your documents and its SQL reproduces the amount. What reaches the report is what a person can re-run and get the same number.
Nothing is filed
Audit Shield produces reports and, under Recovery, draft packets. A person at the dealership approves and submits. There is no path from our system to GlobalConnect or any OEM portal.
Run it on your own VM
For groups: the same governed agent runs on a Linux VM you control, with the evidence log on that VM. Bootstrap generates the keys on the VM; the private halves never leave it. Stop it from the console; access is cut within seconds.
Paperwork
One page, plain English
Before any export is sent, both sides sign a one-page data agreement: purpose (warranty compliance review for the dealer), scope (the listed exports), retention (engagement plus 30 days unless you ask sooner), no training, no resale, no sharing with any OEM or third party, and a named contact on each side. A mutual NDA is available if your group requires one.
Questions about a specific control, a security questionnaire, or your group's vendor review: [email protected].